Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
33 detections
Filters
Last updated
All Time
Detection languages
15
10
3
2
1
Contributors
7
5
4
3
2
Categories
12
9
7
6
5
Platforms
16
10
6
4
3
Products / Services
9
5
3
3
2
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
5
1
IDS Classtypes
1
IDS Protocols
1
Detects high-volume account existence checks targeting the Microsoft Teams API. The rule identifies anomalous authentication attempts characterized by the use of outdated Electron/Chrome user-agent strings associated with the TeamFiltration tool, specifically targeting the Microsoft Teams API AppId (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
This rule monitors for two distinct stages of potential account recovery abuse. First, it detects the execution of suspected Python scripts on an endpoint that contain command-line arguments related to password recovery or authentication codes. Second, it monitors network proxy/web logs for a high volume of API requests to the 'easy4ipcloud.com' domain associated with password reset or device probe endpoints, which may indicate automated credential stuffing or unauthorized device account recovery attempts.
Detects anomalous sign-in patterns from a single IP address that target multiple accounts with a high success rate within a short timeframe. This behavior is indicative of targeted credential guessing or password spraying informed by reconnaissance, as it deviates from the typical low-success-rate patterns of broad brute-force attacks.
This rule monitors cloud and identity logs to detect a single user identity exhibiting multiple stages of suspicious activity (authentication, reconnaissance, and exfiltration) within a 24-hour period while utilizing distinct, non-overlapping source IP addresses for each stage. This behavior is indicative of an account compromise where different stages of the attack chain originate from different infrastructure.
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
Detects individual process-level invocations of Microsoft Graph API endpoints commonly used for reconnaissance of user, group, and role information. This rule acts as a precursor signal to identify potential enumeration activities within an Office 365 environment.
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
This rule retrieves security anomaly events generated by Microsoft's identity protection or behavioral analysis systems for a specific user account over a defined time range. It leverages the 'Anomalies' table within Microsoft Sentinel to surface identity-related insights, activity patterns, and flagged risks.
Detects rapid sequence of unsuccessful (401) followed by successful (201) POST requests to the WordPress user API endpoint from the same source IP, indicating potential brute force or account enumeration attempts.
Detects the malicious GitHub Actions workflow that targets self-hosted runners to run identity-reconnaissance commands (whoami) from the known malicious branch and workflow path.
Detects high volumes of sign-in failures originating from the same IP address, specifically those returning error codes associated with invalid users or incorrect passwords, which is indicative of credential stuffing or user enumeration attacks targeting Entra ID.
Detects Microsoft Entra ID authentication failures (AADSTS700016) where a client ID is provided that does not exist in the directory. This error often indicates attackers attempting to spoof legitimate OAuth client applications to perform reconnaissance or bypass conditional access policies.
Detects Microsoft Entra ID authentication attempts (Resource Owner Password Credentials - ROPC) where the Client ID and Application Display Name are blank. This pattern is indicative of attackers attempting to enumerate users or bypass security controls by using malformed or spoofed client identification in authentication requests.
Detects the execution of PowerShell scripts or commands related to the 'Invoke-ClientIdSpoofEnum' tool, which is used for OAuth client ID spoofing. This technique allows attackers to bypass security controls by enumerating valid client IDs within Microsoft Entra environments, potentially leading to unauthorized token requests.
Detects the use of spoofed Exchange Online Application IDs in Azure sign-in logs. Attackers use these specific spoofed AppID patterns to bypass controls during Resource Owner Password Credential (ROPC) authentication, often for user enumeration purposes.
Detects short-window spikes in Entra sign-in/token-request event volume (exceeding roughly 100,000-250,000 events within a single day per tenant), consistent with automated client-ID-spoofed ROPC enumeration campaigns that exhibit a multi-day burst-then-quiet cadence.
Detects scraping of job listings to identify employee roles and technology stack
This rule detects HTTP requests to a server that contain both 'password' and 'username' in the URI, case-insensitively. This pattern is indicative of a potential credential harvesting attempt where an attacker is trying to collect user credentials via a crafted web page or phishing site. The rule specifically looks for these keywords in the URI of an established HTTP connection flowing to the server.
Page 1 of 2